py-pikepdf: updated to 10.12.0
v10.12.0
Packaging and licensing
- Binary wheels now redistribute the licenses of the compiled third-party
libraries they bundle, along with an attribution manifest mapping each
component to its license. {issue}`736`
- The new `third-party-licenses/` directory documents every vendored binary:
qpdf and libjpeg-turbo on all platforms; OpenSSL and zlib (both statically
linked into `qpdf30.dll`) plus the Microsoft Visual C++ runtime on Windows;
the GnuTLS/Nettle/GMP stack on macOS; and the GCC runtime libraries on
musllinux. It also records what is deliberately *not* bundled -- notably
that Linux wheels use qpdf's built-in crypto and link no TLS library at all.
- These files are declared via PEP 639 `project.license-files`, so they ship
in `pikepdf-<version>.dist-info/licenses/` and are enumerated in the wheel's
`License-File` metadata. `License-Expression` remains `MPL-2.0`: pikepdf's
own license is unchanged, and the bundled libraries are separate works
[70 lines not shown]
py-nanobind: added version 3.0.1
nanobind is a small binding library that exposes C++ types in Python and vice
versa. It is reminiscent of Boost.Python and pybind11 and uses near-identical
syntax. In contrast to these existing tools, nanobind is more efficient:
bindings compile in a shorter amount of time, produce smaller binaries, and
have better runtime performance.
py-strich: updated to 0.20
0.20
All formats: numeric arguments (cell size, render options, encoder settings)
are validated for type and range up front
GS1-128: Code128Data.gs1 rejects payloads over the GS1 maximum of 48 data
characters
py-obspy: updated to 1.5.1
1.5.1
Changes:
- General:
* add helper function that wraps around `numpy.linalg.eig` but always
mimicks the behavior of numpy <2.5, which is to downcast results to real
valued arrays when possible. Replacing all `numpy.linalg.eig` calls in the
code base with this wrapper
- obspy.core:
* inventory: fix a bug that Latitude, Longitude and Distance did not accept
'measurement_units' when being initialized
- obspy.clients.fdsn:
* add new URL mapping 'EARTHSCOPE+USGS' and make it the default. This will
use EarthScope for dataselect and station web services and use USGS for
event web service. This is basically restoring the output users got before
IRIS-now-EarthScope discontinued serving an event web service which was a
mirror of USGS event web service
* update URL endpoint for IGN to https
[32 lines not shown]
py-statsmodels: updated to 0.15.0
0.15.0
SPEC-007: consistent use of rng for randomness
NamedTuple return values replace bare tuples
Formula engine: patsy is no longer the only option
Build system: meson-python replaces setuptools
Polars DataFrame support
New robust estimation tools
New models and statistical tests
New and improved plots
GLM and other model enhancements
Platform and packaging compatibility
Stricter input validation for string-valued options
A few consequential bug fixes
py-interface-meta: added version 2.0.1
interface_meta provides a convenient way to expose an extensible API with
enforced method signatures and consistent documentation.
py-autobahn: updated to 26.7.1
26.7.1
------
**Security**
* Fix WebSocket ``maxMessagePayloadSize`` being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past ``maxMessagePayloadSize`` is now rejected where it previously passed; uncompressed traffic and the per-frame ``maxFramePayloadSize`` wire guard are unaffected
* Fix the permessage-deflate ``max_message_size`` receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded ``decompress(…, max_length)`` left the remaining input in ``unconsumed_tail`` undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises ``PayloadExceededError`` as soon as the uncompressed size would exceed the cap
* Make bounded decompression backend-agnostic: ``decompress_message_data()`` gains an optional ``max_output_len`` argument (documented on the ``PerMessageCompress`` base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by ``maxFramePayloadSize``) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining ``maxMessagePayloadSize`` budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check
* Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio ``WampRawSocketFactory`` now exposes ``setProtocolOptions(maxMessagePayloadSize=...)`` / ``resetProtocolOptions()`` (bounds ``[512, 2**24]``, default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead ``max_size=None`` branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket ``max_message_size`` had no effect on the asyncio path
**FlatBuffers**
* Fix ``check_zlmdb_flatbuffers_version_in_sync()`` comparing the build-time ``version()`` (which is ``(0, 0, 0, None, None)`` on installed wheels, where the vendored FlatBuffers ``__git_version__`` is unstamped) — it now compares the reliably-stamped ``__version__`` and returns a version string. Added regression tests
* Make ``autobahn.flatbuffers.version()`` reliable on installed wheels: when the build-time ``__git_version__`` is a bare commit hash or ``"unknown"`` (shallow clone / submodule absent from the sdist), ``version()`` now falls back to parsing the static vendored ``__version__`` and returns ``(major, minor, patch, None, None)`` instead of ``(0, 0, 0, None, None)``; rich ``git describe`` detail is still returned on genuine dev/git builds. Also hardened ``hatch_build.py`` so it never stamps a non-parseable ``__git_version__``. Return shape is unchanged (5-tuple); no API break
**Build & CI/CD**
[5 lines not shown]
